Summary

We've accomplished a lot in this chapter as well—installing, configuring, and documenting an entire distributed/clustered Splunk Enterprise deployment! I hope that this process, as well as the explanations about some key aspects of Splunk functionality, has helped you start to build a solid foundational understanding of how all the Splunk components work together.

In the next two chapters, we will dive into administering Splunk data inputs, indexes, apps, and users – this will be fun!